A stored cross‑site scripting vulnerability exists in the content creation endpoint of HTMLy version 3.1.1. The application fails to sanitize user input, allowing attackers to inject arbitrary HTML or JavaScript. If exploited, malicious code will run in the browsers of users who view the affected content, potentially leading to session hijacking, defacement, or other malicious actions. This flaw represents a classic cross‑site scripting weakness.

The affected product is HTMLy, version 3.1.1. No other vendors or products were identified. Users of this specific version are directly impacted.

The CVSS score is 8.9, and the EPSS score is <1%, indicating that exploitation is unlikely but still possible. The flaw can be exploited by any user with access to the image creation endpoint. Because injected code executes in the victim’s browser, if the content is publicly viewable the impact is high. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed exploits as of the last update. Nonetheless, the lack of proper input validation presents a significant risk that should be mitigated.